Your agent’s first build.

Point your coding agent at your node and ship an app on the network.

  1. 1
    Plant a node.

    Your agent gets a local endpoint, keys on your device, and a chain it can read and write.

  2. 2
    Hand it the starter.

    One file that describes the network the way an agent needs it: endpoints, the seven precompiles, how to deploy, how to ask for a signature, and an example app. TypeScript and Python SDKs alongside.

    Get the starter
  3. 3
    Ship to a grove.

    Deploy to your node, invite people into an apps grove, and the grove’s verified work starts scoring.

What’s wired today: TypeScript and Python SDKs, OpenAI and Anthropic API shape, EVM-compatible deployment, the Hermes agent runtime. The Commissary catalog in the app is partial; Season 0’s apps groves are where its first entries come from.

The Signature Ceremony.

Every signature, from you or from any agent or app acting for you, routes through a single approval step on your device. Undecodable transactions are blocked until you acknowledge them. One approval yields exactly one signature. Even the app’s own background helpers receive a derived, one-way key for messaging, never the custody key. We call this Human In Control.

Choose your level of proof.

Every job leaves evidence. You choose how much proof you want. Every settled job leaves an exportable receipt, and disputing a bad result slashes the party at fault.

Standard · 1.0×

A committed fingerprint.

The worker commits to the result and stakes against it. Fastest and cheapest, with a receipt and the same dispute-and-slash settlement as every other tier.

Proof · 1.5×

A cryptographic proof.

The work carries a proof of correct execution anyone can verify without re-running it. Pick this when a receipt alone is not enough.

Enclave · 2.0×

A sealed hardware enclave.

Execution runs inside a secure hardware enclave with attestation, so the result is proven correct and the data stays sealed even from the operator.

Your data stays yours.

Sealed at rest with AES-256-GCM under a quantum-safe key exchange. Run the entire network on-premises or fully air-gapped. Federated learning lets the lessons travel while the raw data stays in the building.

Encryption and key exchange

  • AES-256-GCM encrypted storage at rest
  • CRYSTALS-Kyber + X25519 hybrid quantum-safe key exchange
  • HKDF-SHA-256 sub-secret derivation
  • Argon2id password hash

Where it runs

  • On-premises, behind your perimeter
  • Fully air-gapped, with no network at all
  • Ed25519 RFC 8032 signing
  • secp256k1 ECDSA for EVM compatibility

Familiar APIs, open specifications.

Drop-in compatible with the OpenAI and Anthropic APIs, so your tools work unchanged. Seven AI precompiles at 0x1000–0x1004. EVM-compatible deployment on chain 40204. Memory-safe Rust throughout.

npm i @citratelabs/sdkpip install citrate-labs-sdk

Chain 40204 is live: call eth_chainId at rpc.citrate.ai and it returns 0x9d0c. Full reference at docs.citrate.ai.

Open source.

We research in private, validate with third parties, then open source. The whole chain and application layer are open sourced before mainnet, in January 2027. That is a date, not an aspiration.

NATThe model architecture. Memory-safe Rust, formally specified, public.
American Learning FederationThe cooperative that trains NAT through federated learning.
agentile-skillsThe engineering methodology, installable by anyone.

The reward simulator and its fairness invariants ship as tests. To build on the parts not yet public, request access at hello@citrate.ai.

The network.

Citrate is an open market for AI work. Independent providers run inference and training jobs. Every result leaves a receipt you can audit. There are no hourly servers to rent and no lock-in. Anyone can join, every result is proven, and your data stays where you put it.

Built, benchmarked, and running.

These numbers are checked into source and reproducible. The verification packet lists how to confirm each one.

121+​TLA+ specificationsWorkspace-wide formal verification.
50B+​States exploredOn the TransactionSigningFlow specification.
6,720+​Tests automated5,377 Rust + 1,343 Foundry, every commit.
5,000​TPS sustained10,000 ceiling. ≤12 s finality.
Common questions

What is verifiable compute, or proof of inference?

Every job on Citrate leaves evidence, and you choose how strong it is: a committed fingerprint, a cryptographic proof anyone can check, or a sealed hardware enclave. Every settled job leaves an exportable receipt, and disputing a bad result slashes the party at fault.

Can my coding agent build on Citrate?

Yes. Point your coding agent at your node and it gets a local endpoint, keys on your device, and a chain it can read and write; the APIs match the OpenAI and Anthropic shape, with TypeScript and Python SDKs.

How does one human approval per signature work?

Every signature, from you or from an agent acting for you, routes through a single approval step on your device, and one approval yields exactly one signature. Undecodable transactions are blocked until you acknowledge them, and the agent never holds the custody key.

What does keys on device mean?

Your keys are created and held on your own machine, and Citrate Inc. never holds them or sees what you compute. Group messages are end-to-end encrypted and the relay only ever carries ciphertext.

Is Citrate open source?

The whole chain and application layer are open sourced before mainnet, in January 2027. NAT, the American Learning Federation, and agentile-skills are public now, and the rest is available by request.

Plant a node and build.

The SDKs are published and the testnet is open, so the first build is a prompt, not a migration.

Plant your nodeGet the agent starter